CWEweakness

CWE-669 Incorrect Resource Transfer Between Spheres

Official page ↗
Abstraction
Class
Structure
Simple
Status
Draft
Languages
Not Language-Specific
CWE version
5.0

Description

The product does not properly transfer a resource/behavior to another sphere, or improperly imports a resource/behavior from another sphere, in a manner that provides unintended control over that resource.

Common consequences

• Confidentiality, Integrity: Read Application Data, Modify Application Data, Unexpected State

Observed examples

• CVE-2021-22909: Chain: router's firmware update procedure uses curl with "-k" (insecure) option that disables certificate validation (CWE-295), allowing adversary-in-the-middle (AITM) compromise with a malicious firmware image (CWE-494). • CVE-2023-5227: PHP-based FAQ management app does not check the MIME type for uploaded images • CVE-2005-0406: Some image editors modify a JPEG image, but the original EXIF thumbnail image is left intact within the JPEG. (Also an interaction error).

Related

Observed example · CVE (3)

  • CVE-2023-5227 Unrestricted Upload of File with Dangerous Type in GitHub repository thorsten/phpmyfaq prior to 3.1.8. vulnerability
  • CVE-2021-22909 A vulnerability found in EdgeMAX EdgeRouter V2.0.9 and earlier could allow a malicious actor to execute a man-in-the-middle (MitM) attack… vulnerability
  • CVE-2005-0406 A design flaw in image processing software that modifies JPEG images might not modify the original EXIF thumbnail, which could lead to an… vulnerability

Child of · CWE (1)

  • CWE-664 Improper Control of a Resource Through its Lifetime weakness

Referenced by CVE · weakness (125)

  • CVE-2026-114722 Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a CSS scoping bypass in HTML messages. vulnerability
  • CVE-2026-93856 In OpenStack Cinder through 29.0.0, cross-project information disclosure can occur in the Messages API. vulnerability
  • CVE-2026-111445 Wheels 4.0.0 through 4.1.2 before 4.2.0 replaces incoming scope conditions with a primary-key condition in findByKey() and exists(key=). vulnerability
  • CVE-2026-111793 Openwave Webtop Media Transcoder does not enforce administrator-defined file type restrictions to restrict the file-types to be converted. vulnerability
  • CVE-2026-110907 Backdrop CMS Core 1.35.x before 1.35.2 and 1.34.x before 1.34.6 mishandles tokens. vulnerability
  • CVE-2026-106553 In sshd in OpenSSH before 10.6, credentials can incorrectly persist after failure of a GSSAPIAuthentication authentication attempt. vulnerability
  • CVE-2026-106555 In sshd in OpenSSH before 10.6, GSSAPIAuthentication authentication state can incorrectly be persisted across authentication attempts. vulnerability
  • CVE-2026-103106 Pexip Infinity before 38.2, plus 39.0, 39.1, and 40.0, is affected by improper input validation within an internal Pexip Infinity service… vulnerability
  • CVE-2026-47574 NVIDIA vGPU Virtual GPU Manager for Linux contains a vulnerability where an attacker could cause incorrect resource transfer between… vulnerability
  • CVE-2026-98125 In the Linux kernel, the following vulnerability has been resolved: smb/client: fix stale page cache in insert/collapse range… vulnerability
  • CVE-2026-92952 vm2 versions 3.11.4 through 3.11.6 incompletely filter Node.js registered internal symbols across the sandbox boundary. vulnerability
  • CVE-2026-20194 As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Identity Services Engine (ISE) and Cisco ISE… vulnerability
  • CVE-2023-32803 The ca-certificates package before ca-certificates-2021.2.50-72 for Amazon Linux 2 (AL2) does not properly remove certain TrustCor root… vulnerability
  • CVE-2023-37252 An issue was discovered in the CheckUser extension for MediaWiki through 1.39.3. vulnerability
  • CVE-2023-37253 An issue was discovered in the ProofreadPage extension for MediaWiki through 1.39.3. vulnerability
  • CVE-2026-25832 In Mbed TLS 3.6.x before 3.6.7 and 4.1.x before 4.1.2, the TLS 1.3 client accepts HelloRetryRequest selecting an unadvertised group. vulnerability
  • CVE-2026-38924 In Oraios AI Serena before 1.0.0, the listen address of the MCP server in HTTP mode is 0.0.0.0. vulnerability
  • CVE-2025-45480 Floodlight 71fe8a7 allows disruption of host communication via link spoofing. vulnerability
  • CVE-2026-89162 In PCRE2 before 10.48, pcre2_serialize_encode might disclose two bytes to an adversary, typically in a situation where the access available… vulnerability
  • CVE-2026-87724 Tor before 0.4.9.12 interprets the CC_RESPONSE extension even when CC_REQUEST was not sent, which allows remote attackers to cause a denial… vulnerability
  • CVE-2026-86144 In xinclude in libxml2 before 2.15.4, xmlXIncludeProcess and xmlXIncludeProcessTree do not propagate parseFlags. vulnerability
  • CVE-2026-75000 In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, improper HTML/CSS sanitization of the SVG animate "by" attribute may lead to… vulnerability
  • CVE-2026-75003 In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, an unclosed url() in a FuncIRI attribute of an SVG image could evade the remote… vulnerability
  • CVE-2026-75010 In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, the modoboa driver of the password plugin could leak a Modoboa API… vulnerability
  • CVE-2026-73574 In Zimbra Collaboration before 10.1.17, a local file inclusion (LFI) vulnerability exists in the Zimbra Classic Web Client due to improper… vulnerability
  • CVE-2026-71194 In OpenStack Designate before 22.0.2, the mDNS handler performs pool-blind lookups when resolving record queries and NOTIFY requests. vulnerability
  • CVE-2026-73281 In ssh-agent in OpenSSH before 10.5, some operations can occur remotely but were intended to occur only locally, including operations that… vulnerability
  • CVE-2026-14151 Inappropriate implementation in AI in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer… vulnerability
  • CVE-2026-46448 In OpenStack Nova before 33.0.2, the server create API does not strip certain hint data. vulnerability
  • CVE-2026-12068 Information disclosure vulnerability in Avira Password Manager when used with Mozilla Firefox may allow a remote attacker operating a… vulnerability
Show all 125 ›

Referenced by CWE · can precede (1)

  • CWE-244 Improper Clearing of Heap Memory Before Release weakness

Referenced by CWE · child of (7)

  • CWE-1420 Exposure of Sensitive Information during Transient Execution weakness
  • CWE-212 Improper Removal of Sensitive Information Before Storage or Transfer weakness
  • CWE-243 Creation of chroot Jail Without Changing Working Directory weakness
  • CWE-434 Unrestricted Upload of File with Dangerous Type weakness
  • CWE-494 Download of Code Without Integrity Check weakness
  • CWE-565 Reliance on Cookies without Validation and Integrity Checking weakness
  • CWE-829 Inclusion of Functionality from Untrusted Control Sphere weakness

Referenced by CWE · has member (1)

  • CWE-1003 Weaknesses for Simplified Mapping of Published Vulnerabilities view